videosnapshot memory corruption fixes.

1. Fixes memory corruption of dst buffer in
nv21_to_yuv() convertion
2. Free malloced row_tmp buffer
3. Free params string in Appcallback

Change-Id: I2179f1158f6e72cca0f7e5c815b1cb576bfa925e
Signed-off-by: Akwasi Boateng <akwasi.boateng@ti.com>

related-to-bug: 5601247

2 files changed, 8 insertions, 2 deletions

diff --git a/camera/AppCallbackNotifier.cpp b/camera/AppCallbackNotifier.cpp
index b431f54..ea0d2a8 100644
--- a/camera/AppCallbackNotifier.cpp
+++ b/camera/AppCallbackNotifier.cpp
@@ -824,7 +824,8 @@ void AppCallbackNotifier::notifyFrame()
                     }
 
                     CameraParameters parameters;
-                    const String8 strParams(mCameraHal->getParameters());
+                    char *params = mCameraHal->getParameters();
+                    const String8 strParams(params);
                     parameters.unflatten(strParams);
 
                     encode_quality = parameters.getInt(CameraParameters::KEY_JPEG_QUALITY);
@@ -894,6 +895,10 @@ void AppCallbackNotifier::notifyFrame()
                     encoder->run();
                     gEncoderQueue.add(frame->mBuffer, encoder);
                     encoder.clear();
+                    if (params != NULL)
+                      {
+                        mCameraHal->putParameters(params);
+                      }
                     }
                 else if ( ( CameraFrame::IMAGE_FRAME == frame->mFrameType ) &&
                              ( NULL != mCameraHal ) &&
diff --git a/camera/Encoder_libjpeg.cpp b/camera/Encoder_libjpeg.cpp
index f6f6498..0240fb0 100644
--- a/camera/Encoder_libjpeg.cpp
+++ b/camera/Encoder_libjpeg.cpp
@@ -104,7 +104,7 @@ static void nv21_to_yuv(uint8_t* dst, uint8_t* y, uint8_t* uv, int width) {
         return;
     }
 
-    while ((width--) >= 0) {
+    while ((width--) > 0) {
         uint8_t y0 = y[0];
         uint8_t v0 = uv[0];
         uint8_t u0 = *(uv+1);
@@ -452,6 +452,7 @@ size_t Encoder_libjpeg::encode(params* input) {
     jpeg_destroy_compress(&cinfo);
 
     if (resize_src) free(resize_src);
+    if (row_tmp) free(row_tmp);
 
  exit:
     input->jpeg_size = dest_mgr.jpegsize;